ATECC508A datasheet(88/109 Pages) MICROCHIP

88 / 109 page

External Mode

The public key to be used is an input to the command. Prior to this command being run, the

message should be written to TempKey using the Nonce command. In this mode the device merely

accelerates the public key computation and returns a boolean result.

Stored Mode

The public key to be used is found in the KeyID EEPROM slot. The message should have been

previously stored in TempKey. If the following configuration checks for the public key at KeyID

succeed, the public key verification computation is performed and a boolean result is returned to

the system; otherwise, the command returns an execution error.

–

If KeyConfig.PubInfo is one, then the key must have been previously validated using the

Verify command.

–

If KeyConfig.ReqAuth is set, then a previous key authorization must have been performed

with either the Verify or CheckKey commands based on the key in KeyConfig.AuthKey.

–

If KeyConfig.KeyType indicates an ECC curve not supported by the device or indicates “Not

an ECC Key,” then this command will fail.

–

This mode is used to set the key authorization information when the KeyConfig.AuthKey field

within some other slot points to KeyID. If the verification succeeds, then an internal AuthValid

flag will be set and KeyID internally retained in AuthKeyID. See Section Authorized Keys.

–

Data1 and Data2 must be 32 bytes, and Data3 & Data4 should be zero length.

Validate and Invalidate Modes

The Validate and Invalidate modes are used to validate or invalidate the public key stored in the

EEPROM at KeyID. The signature is input to the device and a partial message should be in

TempKey. The verifying public key is found at SlotConfig.ReadKey, and the ECDSA Verify message

is composed of KeyID and TempKey, formatted as noted below. Only KeyIDs 8 – 15 can be

validated; therefore, this command will return an error if KeyID is 0 – 7.

–

If the ECC verification passes, then the most significant four bits of the first byte of Block 0 of

the public key at KeyID will be set to 0x5 for Validate and 0xA for Invalidate. See Section

ECC Key Formatting.

–

Key (in)validation takes place regardless of the state of the LockValue byte and/or the

SlotLocked bit corresponding to this slot.

–

If the X509format<KeyConfig.X509id> byte corresponding to the specified key is non-zero,

then the Verify command will return an error.

Key invalidation works in conjunction with WriteConfig(Bit 12) as shown in Section Write

Permissions to control update of public keys by limiting the options for a fraudulent write

leading to a denial of service. Key Invalidation is supported on the ATECC508A only.

OtherData<17>.Bit0 represents the validity of the key being acted on. It must be a ‘0’ (invalid)

to permit the Validation operation, or a ‘1’ (valid) to permit the Invalidation operation. If

OtherData<17>.Bit0 does not match Mode<2> in Validate/Invalidate modes, then this

command will return an error.

Data1 and Data2 sizes are the same as stored mode.

ValidateExternal Mode

The ValidateExternal mode is used to validate the public key stored in the EEPROM at KeyID when

X.509 format certificates are to be used. The digest of the message must be TempKey. TempKey

must have been generated using the SHA(Public) command, and the key for that computation

must be the same as KeyID. The verifying public key is found at SlotConfig.ReadKey, and the

ATECC508A

Security Commands

Datasheet Complete

DS20005927A-page 88

ATECC508A Datasheet(PDF) 88 Page - Microchip Technology

ATECC508A Datasheet(HTML) 88 Page - Microchip Technology

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 ...More

Datasheet Download

Link URL